Peru’s SBS Requires Banks and Finance Firms to Report Cyber

Peru’s Superintendency of Banking, Insurance and AFPs has issued Resolution SBS No. 01741-2026, amending the Market Conduct Management Regulation and adding new obligations for banks, savings banks and finance companies on transparency, customer service and the handling of operational and cybersecurity incidents.

Public reporting within 24 hours

The new rule requires financial institutions to publicly disclose, through mass media, cybersecurity or business continuity incidents that affect balances, credit lines or financial services within 24 hours of becoming aware of the event. According to analysis published by Nivel4 based on the SBS’s official statement, that includes outages in customer service channels, cybersecurity incidents affecting users and other events that cause economic harm.

In addition to that public notice, for events other than channel outages the rule says institutions must contact affected users directly within 10 business days, explaining the incident and the actions taken.

Compliance deadlines and immediate measures

The SBS said on its official channels that the new rules are intended to strengthen protection for financial users and include a requirement to timely report incidents that may affect them, such as service channel interruptions or cybersecurity incidents. The agency’s accompanying outreach materials also say the rules are designed to improve transparency, customer service and incident response for users’ benefit.

Most of the amendments to the regulation will take effect 360 days after publication in the Official Gazette El Peruano, giving institutions time to adjust processes, platforms and systems. Two measures apply immediately, starting the day after publication, the requirement to offer a human support option when automated systems are in use, and the free issuance of debt regularization certificates upon user request.

Broader regulatory scope

A corporate legal bulletin shared on social media said Resolution SBS No. 01741-2026 also amends the Financial System Fees and Expenses Regulation, affecting the fee and charge structure applied to financial products and services. The same material links the rule to the integrated management of operational and cybersecurity incidents tied to fees and expenses.

In the same vein, a comment shared by LP Derecho, based on a specialized study in financial law, said the resolution seeks to close gaps identified in practice around how contingencies that create economic losses are reported and managed, including incidents that affect balances and credit lines.

A regulatory summary published by Microfinanzas.pe placed the resolution within a broader set of recent SBS rules, alongside regulations for the Banking-as-a-Service model and the addition of concepts such as tokenized assets and blockchain, suggesting a wider strategy for supervising technological and digital risks in Peru’s financial system.